Plugin4Shell — Multi-Vendor AI Coding Agent Plugin SHA-Pinning Bypass

Plugin4Shell is a zero-click remote-code-execution flaw affecting the plugin/marketplace systems of all four major AI coding agents — Anthropic Claude Code, OpenAI Codex, GitHub Copilot, and Google Gemini CLI — disclosed by Air Security researchers Or Nevo, Dor Granat, and Niv Hoffman on 2026-09-17/18. It breaks SHA pinning, the mechanism a marketplace uses to lock an installed plugin to one reviewed commit forever after. Every affected agent checks out the pinned commit but never verifies the checkout actually landed there. An attacker who controls a plugin's upstream repository can make that checkout resolve to a malicious tree — via a branch named identically to the 40-hex pinned SHA (Claude Code, Codex, GitHub Copilot) or via a default branch literally named FETCH_HEAD (Gemini CLI) — while the pin still displays as honored.

What makes it zero-click is plugin auto-update, on by default in Claude Code and Codex: the same checkout logic re-runs in the background whenever the marketplace bumps the pinned commit, silently swapping code inside a plugin the victim already trusts and already installed. No install step, no prompt, nothing to notice. The victim only needs one plugin, installed from a marketplace they trust, that was reviewed and pinned exactly as the security model intends — doing everything right does not protect you.

Patch status: fixed in Claude Code 2.1.179 and OpenAI Codex 0.146.0. GitHub Copilot remains unpatched — Microsoft has not shipped a fix, and exposure persists wherever Copilot supports marketplaces hosted on Bitbucket or self-hosted git (GitHub.com itself structurally blocks SHA-shaped branch names). Google has deprecated Gemini CLI and will not patch it; installs under Gemini Code Assist Standard/Enterprise licensing keep running and stay exposed indefinitely, with migration to Antigravity as the only mitigation.

There is no public report of in-the-wild exploitation and no published malware indicators for Plugin4Shell as of this pack's build. This is deliberately a behavioral + exposure hunt: find vulnerable installs, watch the plugin-update/checkout mechanic itself for the anomaly the attack requires, and catch the post-exploitation behaviors — an unexpected shell spawned from git or from inside a plugin directory, credential-store access, anomalous egress — that a real exploitation attempt would produce on an EDR-visible endpoint even though the exploit's actual "flip" happens server-side, off the endpoint.

Web Hunter Notes

• No CVE ID was identified for Plugin4Shell in any source surveyed as of 2026-09-18.
• A targeted search for coverage on thehackernews.com returned zero matching results at research time — noted as a coverage gap in that specific outlet, not as evidence against the vulnerability (four independent sources above corroborate it).
• GitHub's on-record position (via The Register) is that Plugin4Shell cannot be exploited on GitHub.com because it rejects 40-hex-shaped branch/tag names. Air Security's countered position — that Bitbucket-hosted and self-hosted marketplaces remain exploitable, and that this is exactly why GitHub Copilot (which supports those hosts) is still vulnerable — is carried forward as the operative risk statement in this pack, and is independently supported by Claude Code's own documentation confirming Bitbucket/self-hosted marketplace support (source 08 above).
• Prompt-injection check: all 9 saved source snapshots were scanned for directive-style text aimed at an AI agent (e.g. "ignore previous instructions," fake system/admin authority claims, instructions to fetch further URLs or run commands). None was found in any source. This matters more than usual here since the subject is an attack on AI coding agents themselves — see also the note in §18.

Hunt hypotheses

Attack chain (per Air Security)

Plugin4Shell has no published campaign IOCs — no malware hashes, no C2 domains/IPs, no confirmed in-the-wild exploitation. The rows below are exposure and behavioral indicators only, honestly labelled as such.

Non-CQL checks — run these directly (RTR, SSH, or a management tool) since they read information Falcon process telemetry does not expose (semantic version strings, git ref resolution, marketplace configuration).

1. Fleet version audit

Run via RTR or your software-deployment tool against every managed endpoint:

claude --version
codex --version
gemini --version
gh copilot --version   # or: gh extension list
npm ls -g @anthropic-ai/claude-code
npm ls -g @openai/codex

Flag: Claude Code < 2.1.179, Codex < 0.146.0, any Gemini CLI, any Copilot install with plugin/marketplace features enabled.

2. Per-plugin pin-vs-HEAD audit

This is literally the check the vulnerable agents omit — running it out-of-band is the strongest manual verification available. For each installed plugin directory, compare the resolved commit against the pin recorded in the marketplace's manifest/lock entry for that plugin:

git -C <plugin_dir> rev-parse HEAD
# Compare the output against the SHA the marketplace manifest recorded as pinned
# for this plugin. Any mismatch is a direct compromise indicator.

3. SHA-shaped branch / bad-default-branch audit

Run against any plugin repository your organization controls or mirrors:

git ls-remote --heads <repo> | grep -E '[0-9a-f]{40}'      # SHA-shaped branch names
git remote show <repo> | grep 'HEAD branch'                 # must never be a 40-hex name or "FETCH_HEAD"

4. Marketplace host inventory

Enumerate configured plugin marketplaces per agent (Claude Code: ~/.claude/settings.json marketplace entries; check equivalent configuration for Codex/Copilot in your environment) and flag any entry hosted on Bitbucket or a self-hosted git server as elevated risk until the corresponding agent is confirmed patched.

Three queries clear the bar for Custom IOA promotion (high CONF, low-medium FP, low cost). Deploy all three in Detect mode fleet-wide first; do not jump to Prevent given AI agents' legitimately high baseline of shell/script activity (see §11 Validation Gates).

IOA-1 — Git Process Spawning a Shell/Script Interpreter (from Q5)

Pattern: ParentBaseFileName matches git AND the child's FileName matches a shell/script-interpreter list. Exclusions: known CI runner images; repos with reviewed git hooks (husky/lint-staged) outside agent plugin directories. Deployment: Falcon Custom IOA rule, Detect mode, 14-day burn-in.

Scheduled Search: DETECT — Git Hook Spawns Interpreter (Plugin4Shell) — fires on any git-parented interpreter process; investigate whether the parent git operation touched a plugin path (cross-reference Q3) before escalating.

Triage: (1) confirm the parent git command from CommandLine, (2) check whether the working directory is an agent plugin path, (3) pull the child process's own CommandLine and any subsequent network/file activity, (4) check Q7 for the same host/timeframe, (5) if plugin-path-confirmed and unexpected, isolate the host and proceed to §14 Containment.

IOA-2 — Interpreter/LOLBin Executing From a Plugin Path (from Q6)

Pattern: ImageFileName contains a plugin-path segment AND FileName matches a shell/interpreter/LOLBin list. Exclusions: first-install window per plugin path; allowlisted publishers. Deployment: Custom IOA, Detect mode, 14-day burn-in, then evaluate Prevent for allowlisted-publisher exclusions only.

IOA-3 — Credential-Store Access From Git/Plugin-Spawned Process (from Q7)

Pattern: parent is git or image path contains a plugin segment, AND CommandLine references a credential-store path. Exclusions: none by default — this pattern is already narrow; widen only with a documented business reason. Deployment: Custom IOA, Detect mode; strong Prevent candidate after a clean 14-day burn-in given its low native FP.

Pivot queries: host-scoped — re-run Q5/Q6/Q7 with aid = "<affected aid>" added as the first filter after #event_simpleName; environment-wide — drop the host scope and widen §8's 7-day lookback to 30 days to check for a broader campaign.

Plugin4Shell ships no campaign IOCs. The grid below is grouped for quick-copy convenience — vulnerable/fixed version strings, plugin path patterns, and process names — not a blocklist of malicious infrastructure.

type,value,action,severity,expiration,description,tags
filename,REPLACE_WITH_your-tenant-plugin-cache-path,hunt,medium,2027-03-18,Plugin4Shell plugin-path scoping value — no campaign IOC published,supply-chain:Plugin4Shell
domain,REPLACE_WITH_your-approved-marketplace-host,enrich,low,2027-03-18,Plugin4Shell allowlist entry for Q8 — populate with your tenant's actual marketplace host,supply-chain:Plugin4Shell

Claude Code:  VULNERABLE  < 2.1.179   |  FIXED  >= 2.1.179  (fixed 2026-06-17)
OpenAI Codex: VULNERABLE  < 0.146.0   |  FIXED  >= 0.146.0  (fix verified 2026-08-12)
GitHub Copilot: VULNERABLE, all versions with marketplace plugins enabled — no fix shipped
Gemini CLI:   VULNERABLE, all versions — deprecated 2026-08-04, will not be patched

Process basenames: claude, claude-code, codex, gemini, copilot, github-copilot, gh-copilot, git
Confirmed plugin cache path (Claude Code): ~/.claude/plugins/cache
Codex/Copilot/Gemini plugin paths: REPLACE_WITH_confirmed-path (not published in sources surveyed — validate via native audit §7.4)
Generic path-scoping wildcard used in §8 queries: *plugin*

claude --version; codex --version; gemini --version; gh copilot --version
git -C <plugin_dir> rev-parse HEAD
git ls-remote --heads <repo> | grep -E '[0-9a-f]{40}'
git remote show <repo> | grep 'HEAD branch'

Playbook A — Fleet-Wide Agent Version Enforcement

MITRE: T1195.002 → M1051   Estimated deploy time: 1-2 hours to script + one RTR/deployment-tool push cycle   Prerequisites: RTR access or existing software-deployment tooling; network path to each vendor's package registry (npm for Claude Code/Codex)   Reboot required: No

Step 1 — Audit current versions fleet-wide

What it does: establishes which hosts are below the fixed version. Why it works: you cannot enforce a patch you haven't measured compliance against.

# Run via RTR against each managed endpoint (or your fleet's equivalent)
claude --version
codex --version
# Collect results centrally; flag Claude Code < 2.1.179 and Codex < 0.146.0

Verify: aggregate the returned versions; the count of non-compliant hosts is your rollout scope.

Rollback: none required — this step is read-only.

Step 2 — Push the update

# npm-based installs
npm install -g @anthropic-ai/claude-code@latest
npm install -g @openai/codex@latest

# Native installer path — re-run the vendor's install/update command, then:
# restart the terminal / re-launch the agent for the update to take effect

Verify: re-run Step 1's version check; expect ≥2.1.179 / ≥0.146.0 fleet-wide.

Rollback: npm install -g @anthropic-ai/claude-code@<previous-version> / @openai/codex@<previous-version> if the update breaks an unrelated workflow — note that rolling back re-exposes the host to Plugin4Shell, so treat this as a short-lived exception only, tracked to a re-patch date.

Playbook B — Marketplace Host Restriction (GitHub-Only)

MITRE: T1195.002 → M1033   Estimated deploy time: 2-4 hours   Prerequisites: administrative access to each agent's marketplace configuration; inventory of currently-configured marketplace hosts (§7.4)   Reboot required: No

Step 1 — Inventory configured marketplaces

# Claude Code marketplace entries live under enabledPlugins / marketplace config in:
cat ~/.claude/settings.json
# Review each marketplace's source URL for a non-GitHub git host (Bitbucket, GitLab,
# self-hosted). Repeat against your organization's Codex/Copilot marketplace config.

Verify: a list of every non-GitHub-hosted marketplace currently trusted.

Rollback: none required — read-only.

Step 2 — Remove or risk-accept non-GitHub marketplaces

# Remove a marketplace (Claude Code):
/plugin marketplace remove <marketplace-name>

# If a non-GitHub marketplace is a genuine business requirement, document a formal
# risk acceptance and compensate with the §8 Q5/Q6/Q7 Custom IOAs in Detect mode
# specifically for hosts using that marketplace.

Verify: §7.4 marketplace host inventory returns zero non-GitHub hosts, or each remaining one is attached to a documented risk acceptance.

Rollback: re-add the marketplace with /plugin marketplace add <url> if removal breaks a required workflow; this restores the underlying exposure, so pair any rollback with the Custom IOA compensating control from Step 2.

See §11 for the full Detection Validation Gates (telemetry readiness, benign baselining, positive testing, and the promotion criteria for Q5/Q6/Q7 into Custom IOAs).

All 9 sources above were saved as plain-text snapshots at build time and scanned for prompt-injection content directed at an AI research agent. No injection attempt was found in any source. Given that Plugin4Shell's subject matter is an attack on AI coding agents themselves, this check was treated as mandatory rather than optional for every fetched page.